Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

internal/bootstrap/talk.go

@@ -13,13 +13,13 @@ import (
 //
 // **Through `docker exec`, not over a network.** The control plane listens on nothing — `serve` is
 // a broker consumer, and every administrative verb is a subcommand of the same binary that opens
-// the stores directly (mesh-control's own usage). So the way to tell a mesh anything, from the
+// the stores directly (mesh-controller's own usage). So the way to tell a mesh anything, from the
 // machine the mesh is on, is to run its binary inside its own container. That is also what the lab
 // does, and having the installer and the lab drive the mesh identically is the point: the lab is
 // meant to exercise the installer, not a second procedure that resembles it.
 //
 // It carries which container, because the whole pivot turns on there being two of them: the
-// substrate's `temp-mesh-control` for steps 6 to 9, and the module's `mesh-control` afterwards.
+// foundation's `temp-mesh-controller` for steps 6 to 9, and the module's `mesh-controller` afterwards.
 type controlPlane struct {
 	container string
 	run       Runner
@@ -35,9 +35,9 @@ func (c controlPlane) within(timeout time.Duration) controlPlane {
 	return c
 }
 
-// tell runs a mesh-control subcommand and gives back what it said.
+// tell runs a mesh-controller subcommand and gives back what it said.
 //
-// The failure carries the command AND the output. A mesh-control refusal is a paragraph explaining
+// The failure carries the command AND the output. A mesh-controller refusal is a paragraph explaining
 // what is wrong — "nothing provides route, wanted by registry" — and an installer that reported
 // only "exit status 1" would throw away the one thing a person needs.
 func (c controlPlane) tell(ctx context.Context, args ...string) (string, error) {
@@ -83,7 +83,7 @@ func (c controlPlane) carry(ctx context.Context, local, remote string) error {
 // crash-looped on material it never received. There is no shell in the image to chown it with.
 //
 // What goes through here is a module manifest and a store connection string. The connection is the
-// same value the produced bundle already holds in the clear — a substrate names its own bootstrap
+// same value the produced bundle already holds in the clear — a foundation names its own bootstrap
 // credentials, and at genesis there is nowhere else for them to be — so this widens nothing. The
 // file on the machine is removed at once, and the copy inside the container goes when the
 // container does, which for the temporary control plane is step 10.
@@ -107,7 +107,7 @@ func indent(s string) string {
 //
 // Line-and-word rather than a substring search, because these listings are columns and a
 // substring match would find `registry` inside `registry-mirror` and report a module installed
-// that is not. Every one of mesh-control's `list` verbs prints the name first on the line.
+// that is not. Every one of mesh-controller's `list` verbs prints the name first on the line.
 func mentions(listing, name string) bool {
 	for _, line := range strings.Split(listing, "\n") {
 		first, _, _ := strings.Cut(strings.TrimSpace(line), " ")